You don't know file Upload vulnerability PHP code Analysis _php Instance

Vulnerability description

Development of the file upload function is very common, as developers, in the completion of the function on the basis of our general to do a good job of security protection.
File processing generally contains two functions, user upload and display files, such as upload avatar.

File Upload Attack example

upload.php

<?php
$uploaddir = ' uploads/'; 
$uploadfile = $uploaddir. basename ($_files[' userfile '] [' name ']);
if (Move_uploaded_file ($_files[' userfile '] [' tmp_name '], $uploadfile)) {
 echo "file is valid, and was successfully Uploaded.\n ";
} 
else {
 echo ' File uploading failed.\n ';
}
? >

Upload.html

<form name= "Upload" action= "upload1.php" method= "POST" enctype= "Multipart/formdata" >
Select the file to Upload: <input type= "file" name= "UserFile" >
<input type= "Submit" name= "Upload" value= "upload" >
</form>

The above code without any verification, malicious users can upload PHP files, the code is as follows

<?php eval ($_get[' command '));? >

Malicious users can access such as http://server/uploads/shell.php?command=phpinfo (); To execute the remote command

Content-type Verification

upload.php

<?php
if ($_files[' userfile '] [' type ']!= ' image/gif ') {//Get HTTP request header information contenttype
 echo "Sorry, we only allow Uploading GIF images ";
 Exit;
}
$uploaddir = ' uploads/';
$uploadfile = $uploaddir. BaseName ($_files[' userfile '] [' name ']);
if (Move_uploaded_file ($_files[' userfile '] [' tmp_name '], $uploadfile)) {
 echo "file is valid, and was successfully Uploaded.\n ";
} else {
 echo ' File uploading failed.\n ';
}
? >

This is done through HTTP request header information, and can be modified by modifying the Content-type ==> image/jpg bypassing authentication, through scripting or burpsuite, fiddle modifying
As follows
Content-disposition:form-data; Name= "UserFile"; Filename= "shell.php"
Content-type:image/gif

Picture type validation

This method gets the file type by reading the file type information in the header

Note: If the jpeg/jpg file header is identified as FFD8

upload.php

<?php
$imageinfo = getimagesize ($_files[' userfile '] [' tmp_name ']);
if ($imageinfo [' MIME ']!= ' image/gif ' && $imageinfo [' MIME ']!= ' image/jpeg ') {
 echo "Sorry, we only accept GIF and JPEG images\n ";
 Exit;
}
$uploaddir = ' uploads/';
$uploadfile = $uploaddir. basename ($_files[' userfile '] [' name ']);
if (Move_uploaded_file ($_files[' userfile '] [' tmp_name '], $uploadfile)) {
 echo "file is valid, and was successfully Uploaded.\n ";
} else {
 echo ' File uploading failed.\n ';
}
? >

You can bypass this validation by adding a comment to the picture.
If you add a comment <?php phpinfo (), Save the picture and change its extension to PHP, you can upload it successfully.
After the upload is successful, you can access the file to see the following display

File name extension validation

Filter the file name extension through a blacklist or whitelist, as shown in the following code

upload.php

<?php
$blacklist = Array (". php", ". phtml", ". PhP3", ". PhP4");
foreach ($blacklist as $item) {
if (Preg_match ("/$item \$/i", $_files[' userfile ' [' name '])) {
 echo "We do not Allow uploading PHP files\n ";
 Exit;
}
}
$uploaddir = ' uploads/';
$uploadfile = $uploaddir. basename ($_files[' userfile '] [' name ']);
if (Move_uploaded_file ($_files[' userfile '] [' tmp_name '], $uploadfile)) {
 echo "file is valid, and was successfully Uploaded.\n ";
} else {
 echo ' File uploading failed.\n ';
}
? >

When a blacklist is incomplete, a special file name can be constructed to bypass extension validation

Direct access to uploaded files

Saving an uploaded file under a different folder than Web root prevents users from accessing the file directly through the path.
upload.php

<?php
$uploaddir = ' d:/uploads/';
$uploadfile = $uploaddir. basename ($_files[' userfile '] [' name ']);
if (Move_uploaded_file ($_files[' userfile '] [' tmp_name '], $uploadfile)) {
echo "file is valid, and being successfully up Loaded.\n ";
} else {
echo ' File uploading failed.\n ';
}
? >

Users cannot access files directly through http://localhost/uploads/, and must access them through view.php
view.php

<?php
$uploaddir = ' d:/uploads/';
$name = $_get[' name '];
ReadFile ($uploaddir. $name);
>

View the file code does not verify the file name, the user can view the specified file through such as http://localhost/view.php?name=..//php/upload.php

Example of a vulnerability resolution

upload.php

<?php
require_once ' db.php ';
$uploaddir = ' d:/uploads/'; 
$uploadfile = Tempnam ($uploaddir, "Upload_");
if (Move_uploaded_file ($_files[' userfile '] [' tmp_name '], $uploadfile)) {
$db =& db::connect ("mysql://　　Username:password@localhost/database ");
if (Pear::iserror ($db)) {
unlink ($uploadfile);
Die "Error connecting to the" database;
$res = $db->query ("INSERT into uploads SET name=?, original_name=?,mime_type=?",
Array (basename ($up　　Loadfile,basename ($_files[' userfile '] [' name ']), $_files[' userfile '] [' type ']);
if (Pear::iserror ($res)) {
unlink ($uploadfile);
Die "Error saving data to the database.　　The file is not uploaded ";
$id = $db->getone (' SELECT last_insert_id () from uploads ');
echo "File is valid, and was successfully uploaded. You can view it <a href=\ "view.php?id= $id \ >here</a>\n";
} else {
echo ' File uploading failed.\n ';
}
? >

view.php

<?php
require_once ' db.php ';
$uploaddir = ' d:/uploads/';
$id = $_get[' id '];
if (!is_numeric ($id)) {
die ("File ID must be numeric");
}
$db =& db::connect ("mysql://root@localhost/db");
if (Pear::iserror ($db)) {
die ("Error Connecting to the Database");
}
$file = $db->getrow (' SELECT name, mime_type from uploads WHERE id=? ', Array ($id), DB_FETCHMODE_ASSOC);
if (Pear::iserror ($file)) {
die ("Error fetching data from the database");
}
if (Is_null ($file) | | | | COUNT ($file) ==0) {
die ("File not Found");
}
Header ("Content-type:"). $file [' Mime_type ']);
ReadFile ($uploaddir. $file [' name ']);
? >

The above code file name randomly changes, the file is stored in the Web root, the user ID in the database query file name, read files, can effectively prevent the above vulnerabilities occur

Summarize

Through the above example analysis, we can sum up some

1. File name modification, do not use the user uploaded file name

2. Users can not access files directly through the upload path

3. File view using the database to get the file name, so that the appropriate file server read files

4. File upload limit file size, personal upload quantity, etc.

  above is the entire content of this article, I hope to help you learn, but also hope that we support the cloud-dwelling community.